ShinyHunters Claims FBI Breach via Unpatched Oracle PeopleSoft Zero-Day, Threatens 2-3TB of PII/PHI Leak

Key facts

Detection coverage

As of 2026-09-27, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2620 across Splunk SPL, Microsoft KQL and Sigma, covering 24 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: PeopleSoft Post-Exploitation: PSEMHUB.war Web Shell Drop, psappsrv.cfg Credential Access, and Azure-Masquerading MeshCentral Agent

Detects ShinyHunters/UNC6240 post-exploitation tradecraft against compromised PeopleSoft hosts: unexpected .jsp file creation under the PSEMHUB.war deployment path, unusual process access to the psappsrv.cfg application-server configuration file (credential extraction), execution of meshagent64-azure-ops.exe (a MeshCentral remote-access agent masquerading as a Microsoft Azure binary), and drop of the actor's README-IF-YOU-SEE-THIS-YOUVE-BEEN-HACKED.TXT marker file.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1505.003, T1552.001, T1036.005, T1110.003
• Data sources: sysmon, windows_security, microsoft_defender_for_endpoint, edr_file_events, edr_process_events
• Severity: critical
• Confidence: high

Splunk SPL

index=endpoint sourcetype IN ("XmlWinEventLog:Microsoft-Windows-Sysmon/Operational","sysmon","WinEventLog:Security") (EventCode=11 OR EventCode=1)
( (EventCode=11 AND TargetFilename="*webserv*applications*peoplesoft*PSEMHUB.war*" AND TargetFilename="*.jsp")
  OR (EventCode=11 AND TargetFilename="*README-IF-YOU-SEE-THIS-YOUVE-BEEN-HACKED.TXT*")
  OR (EventCode=1 AND (Image="*meshagent64*azure*" OR OriginalFileName="meshagent64.exe" AND Image!="*\\Program Files\\MeshAgent\\*"))
  OR (EventCode=11 AND TargetFilename="*psappsrv.cfg" AND Image!="*\\psadmin.exe" AND Image!="*\\pscfg.exe")
)
| eval detection_reason=case(
    match(TargetFilename,"(?i)PSEMHUB\.war.*\.jsp"), "webshell_drop_psemhub",
    match(TargetFilename,"(?i)README-IF-YOU-SEE-THIS"), "shinyhunters_marker_file",
    match(Image,"(?i)meshagent64.*azure"), "meshcentral_azure_masquerade",
    match(TargetFilename,"(?i)psappsrv\.cfg"), "psappsrv_cfg_unusual_access",
    true(), "other")
| stats count min(_time) as first_seen max(_time) as last_seen values(detection_reason) as reasons values(TargetFilename) as files values(Image) as images values(Hashes) as hashes by ComputerName, User
| sort -count

Microsoft KQL

let SuspiciousImages = dynamic(["meshagent64-azure-ops.exe"]);
let KnownHash = "f02a924c9ff92a8780ce812511341182c6b509d45bc59f3f7b522e37225d24fc";
union
(DeviceFileEvents
| where Timestamp > ago(24h)
| where FolderPath has "PSEMHUB.war" and FileName endswith ".jsp"
| extend Reason = "webshell_drop_psemhub"),
(DeviceFileEvents
| where Timestamp > ago(24h)
| where FileName =~ "README-IF-YOU-SEE-THIS-YOUVE-BEEN-HACKED.TXT"
| extend Reason = "shinyhunters_marker_file"),
(DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName has_any (SuspiciousImages) or SHA256 == KnownHash or (ProcessCommandLine has "meshagent" and ProcessCommandLine has "azure")
| extend Reason = "meshcentral_azure_masquerade"),
(DeviceFileEvents
| where Timestamp > ago(24h)
| where FileName =~ "psappsrv.cfg" and ActionType in ("FileAccessed", "FileOpened")
| where InitiatingProcessFileName !in ("psadmin.exe", "pscfg.exe")
| extend Reason = "psappsrv_cfg_unusual_access")
| summarize EventCount = count(), FirstSeen = min(Timestamp), LastSeen = max(Timestamp), Reasons = make_set(Reason), Files = make_set(FileName) by DeviceName
| sort by EventCount desc

Sigma

title: PeopleSoft Post-Exploitation Web Shell, Config Credential Theft, and MeshCentral Azure Masquerade
id: 3d9e5c71-4a8f-4c2b-b5e0-1f7a9d3c6e42
status: experimental
description: Detects UNC6240/ShinyHunters post-exploitation activity on compromised Oracle PeopleSoft hosts - .jsp web shell drop under PSEMHUB.war, credential-file access on psappsrv.cfg, execution of a MeshCentral agent masquerading as an Azure binary (meshagent64-azure-ops.exe), and the actor's README-IF-YOU-SEE-THIS-YOUVE-BEEN-HACKED.TXT marker.
references:
    - https://www.rapid7.com/blog/post/etr-active-exploitation-of-oracle-peoplesoft-zero-day-cve-2026-35273/
    - https://arcticwolf.com/resources/blog/critical-oracle-peoplesoft-vulnerability-actively-exploited-in-shinyhunters-campaign/
author: Threadlinqs Team
date: 2026-09-22
tags:
    - attack.persistence
    - attack.t1505.003
    - attack.credential-access
    - attack.t1552.001
    - attack.defense-evasion
    - attack.t1036.005
    - attack.tool.meshcentral
    - cve.2026.35273
    - attack.group.shinyhunters
    - attack.group.unc6240
logsource:
    category: file_event
    product: windows
detection:
    selection_webshell:
        TargetFilename|contains: 'PSEMHUB.war'
        TargetFilename|endswith: '.jsp'
    selection_marker:
        TargetFilename|endswith: 'README-IF-YOU-SEE-THIS-YOUVE-BEEN-HACKED.TXT'
    selection_meshagent:
        Image|contains: 'meshagent64'
        Image|contains: 'azure'
    selection_cfg_access:
        TargetFilename|endswith: 'psappsrv.cfg'
    filter_admin_tools:
        Image|endswith:
            - '\psadmin.exe'
            - '\pscfg.exe'
    condition: (selection_webshell or selection_marker or selection_meshagent or selection_cfg_access) and not filter_admin_tools
falsepositives:
    - Legitimate PeopleSoft administrators reading psappsrv.cfg via psadmin.exe or pscfg.exe
    - Legitimate deployment of application .jsp files during a scheduled PeopleSoft patch window
level: critical

Known false positives:

• Scheduled PeopleSoft patch/deployment windows that legitimately write .jsp files under webserv paths
• PeopleSoft administrators reading psappsrv.cfg through approved admin tooling (psadmin.exe, pscfg.exe)

Tuning notes: Maintain an allowlist of the PeopleSoft deployment/build service accounts and change-window IDs that are permitted to write into PSEMHUB.war; alert immediately (no threshold) on any hash match against f02a924c9ff92a8780ce812511341182c6b509d45bc59f3f7b522e37225d24fc since that binary has no legitimate purpose in this environment. Pair with a Windows Security 4625/4648 password-spray correlation (T1110.003) against PeopleSoft service accounts.

• 🔒 Oracle PeopleSoft Integration Gateway SSRF-to-RCE Exploitation Attempt (KQL Primary) · unlock with TL Creds
• 🔒 PeopleSoft Post-Exploitation: Web Shell, Config Credential Access, and Azure-Masquerading MeshCentral Agent (Sentinel Primary) · unlock with TL Creds
• 🔒 PeopleSoft-to-Cloud C2 Beaconing and AWS GovCloud Lateral Movement / Bulk Exfiltration (Sentinel Primary) · unlock with TL Creds
• 🔒 Sigma: PeopleSoft Integration Gateway SSRF-to-RCE Exploitation and Forced SMB Authentication · unlock with TL Creds
• 🔒 Sigma: PeopleSoft Web Shell, Credential-File Access, and Azure-Masquerading MeshCentral Agent · unlock with TL Creds
• 🔒 Sigma: C2 Beaconing to [indicator] / UNC6240 Staging Infrastructure and Remote System Discovery · unlock with TL Creds
• 🔒 Oracle PeopleSoft Integration Gateway SSRF-to-RCE Exploitation Attempt (PSEMHUB/PSIGW) · unlock with TL Creds
• 🔒 PeopleSoft-to-Cloud C2 Beaconing ([indicator]) and AWS GovCloud Lateral Movement / Exfiltration · unlock with TL Creds

Indicators of compromise

As of 2026-09-27, Threadlinqs Intelligence tracks 24 indicators of compromise for TL-2026-2620.

Sample indicators (3 of 24)

• IP address: 142.11.200[.]186
• Domain: fbijobs[.]gov
• File hash: f02a924c9ff92a8780ce812511341182c6b509d45bc59f3f7b522e37225d24fc

Defanged, TLP:CLEAR. Full set of 24 indicators: unlock with TL Creds.

Community OSINT corroboration

3 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.

Technical analysis

The group defaced the portal, released a ~5,000-record sample independently spot-checked as partly accurate by 404 Media, and is demanding the FBI retract a May 2026 FLASH bulletin rather than paying a ransom; the FBI confirms it is investigating but has not confirmed a breach.

On the night of Monday, September 21, 2026, the extortion collective ShinyHunters (operating as part of the loosely affiliated "Scattered Lapsus$ Hunters" / "The Com" cluster) told BleepingComputer and 404 Media it had exploited a previously unknown, unpatched remote-code-execution zero-day in Oracle PeopleSoft to compromise the FBI's public-facing Special Agent Applicant Portal (apply.fbijobs.gov). The group claims it used the initial foothold to move laterally into FBI-managed Amazon Web Services GovCloud infrastructure and exfiltrate 2-3TB of data spanning FBI Criminal Justice Information Services records, HR files, the FBI's Medlink medical/employee-health service, and job-applicant records covering current and former employees and prospective Special Agents.

ShinyHunters briefly defaced apply.fbijobs.gov with its trademark Umbreon (Pokemon) logo and a "seized by ShinyHunters" banner before the FBI took the portal offline. As proof, the group gave 404 Media a sample of roughly 5,000 purported employee records containing names, home addresses, phone numbers, and family-member details; 404 Media cross-referenced a subset of the phone numbers against OSINT tooling and found some corresponded to real individuals, including numbers associated with U.S. Department of Justice personnel. Neither the FBI, Oracle, nor AWS has confirmed a breach, a zero-day, or data theft; the FBI's only statement is that it is "aware of claims regarding unauthorized activity affecting FBIjobs.gov and is currently investigating." No CVE has been assigned and no proof-of-concept or technical indicators for the underlying PeopleSoft flaw have been published.

Unusually for the group, ShinyHunters states the attack is "not financially motivated" and that it is not seeking a ransom but rather "coercion": it is demanding the FBI, addressed to Director Kash Patel and Cyber Division Assistant Director Brett Leatherman, retract or correct a May 15, 2026 FBI FLASH/PSA bulletin that named ShinyHunters and Scattered Spider (tracked by Google as UNC6040/UNC6395) for a Salesforce data-theft extortion campaign and accused the group of harassment tactics including swatting and threats against victims' families. ShinyHunters also claims it is now exploiting the same new PeopleSoft zero-day against other, unnamed Fortune 500 organizations.

The incident sits inside an active feud between ShinyHunters and the Cl0p ransomware gang over ownership of a separate, already-patched Oracle flaw: CVE-2025-61882, an unauthenticated RCE in the BI Publisher Integration of Oracle E-Business Suite's Concurrent Processing component that Cl0p exploited as a zero-day from August 2025 before an October 2025 patch. Scattered Lapsus$ Hunters (including ShinyHunters) subsequently leaked the exploit and partial Oracle source code, asserting Cl0p had obtained "their" exploit without authorization. Days before the FBI claims, on September 19, 2026, ShinyHunters hijacked Cl0p's own dark-web leak site via an unauthenticated file-upload vulnerability in its Grav CMS, demanding an eight-figure cut of Cl0p's EBS extortion proceeds. ShinyHunters says it exfiltrated the leak site's source code, Grav CMS plugins, and server logs, and -- most significantly -- the private keys for Cl0p's Tor (.onion) hidden service, which it claims would let it operate Cl0p's dark-web leak address independently. ShinyHunters is also the actor Google Threat Intelligence Group/Mandiant track as UNC6240, which exploited a different, since-patched Oracle PeopleSoft PeopleTools RCE (CVE-2026-35273, patched out-of-band by Oracle on June 10, 2026) as a zero-day against more than 100 organizations, predominantly in education, in mid-2026 -- establishing a clear pattern of the group weaponizing unauthenticated Oracle enterprise-application RCEs as zero-days ahead of vendor disclosure. The zero-day claimed in this FBI incident is presented by ShinyHunters as a newly found, still-unpatched flaw distinct from CVE-2026-35273.

The CVE-2026-35273 campaign gives the clearest public technical picture of how UNC6240/ShinyHunters operates once inside a PeopleSoft environment, and is the closest available proxy for the mechanics of the still-undisclosed FBI zero-day. Per Rapid7 and Arctic Wolf incident-response telemetry, the actor exploited an unauthenticated SSRF-to-RCE chain via the /PSEMHUB/hub and /PSIGW/HttpListeningConnector Integration Gateway endpoints, using the SSRF to force outbound SMB connections capable of capturing Windows NetNTLM hashes; deployed MeshCentral remote-access agents disguised as Microsoft Azure binaries (e.g. meshagent64-azure-ops.exe) that beaconed to a C2 domain, azurenetfiles.net, masquerading as Azure over WSS/443; dropped .jsp web shells and XMLDecoder-based persistence under compromised PeopleSoft webserv/PSEMHUB.war paths; extracted credentials directly from PeopleSoft's psappsrv.cfg application-server configuration files; ran credential-spraying scripts and remote-system discovery to map web/app/batch server tiers for lateral movement; staged stolen data with zstd compression prior to exfiltration; and left a README-IF-YOU-SEE-THIS-YOUVE-BEEN-HACKED.TXT marker on compromised hosts before publishing victim data to its leak site. This same actor's demonstrated, PeopleSoft-specific tradecraft is the basis for the additional ATT&CK techniques mapped below, since no independent technical telemetry has yet been published for the FBI-specific zero-day itself.

The claimed FBI compromise is also the latest in a string of 2026 FBI-adjacent incidents: in March 2026 the FBI disclosed a separate, unrelated "major incident" breach of its Digital Collection System Network (DCSNet) wiretap/surveillance infrastructure -- suspected to be Chinese state-sponsored and reportedly reached via a compromised ISP vendor -- and the Iran-linked "Handala" group separately compromised FBI Director Kash Patel's personal Gmail account and published stolen emails and photos. Those incidents are unrelated to ShinyHunters and are noted here only as target-profile context.

MITRE ATT&CK techniques by tactic:

Discovery

T1018 Remote System Discovery

Defense Evasion

T1036.005 Match Legitimate Resource Name or Location

Command and Control

T1071.001 Web Protocols; T1219 Remote Access Tools

Credential Access

T1110.003 Password Spraying; T1187 Forced Authentication; T1552.001 Credentials In Files; T1552.004 Private Keys

Initial Access

T1190 Exploit Public-Facing Application

Collection

T1213 Data from Information Repositories; T1530 Data from Cloud Storage; T1560 Archive Collected Data

Impact

T1491.002 External Defacement

Persistence

T1505.003 Web Shell

Resource Development

T1588.005 Exploits; T1588.006 Vulnerabilities

Reconnaissance

T1595.002 Vulnerability Scanning

Remediation

Patches

• No vendor patch or advisory exists yet for the specific zero-day claimed in this incident; monitor oracle.com/security-alerts for a new PeopleSoft/PeopleTools bulletin
• Apply Oracle's June 10, 2026 out-of-band Security Alert for CVE-2026-35273 (PeopleTools 8.61/8.62) if not already deployed
• Confirm the October 2025 Oracle patch for CVE-2025-61882 (E-Business Suite Concurrent Processing / BI Publisher Integration) is applied on any EBS instances

Immediate actions

• Audit and restrict internet-facing Oracle PeopleSoft / PeopleTools deployments; consider temporarily gating access behind a WAF or VPN pending vendor guidance on the newly claimed zero-day
• Rotate credentials and review access logs for HR, Medlink-equivalent health/benefits, and Criminal-Justice-Information-Services-adjacent integrations reachable from PeopleSoft application servers
• Review cloud (AWS GovCloud or equivalent) IAM, VPC flow, and CloudTrail logs for anomalous lateral movement originating from PeopleSoft/PeopleTools application hosts
• Enable defacement/file-integrity monitoring on public-facing recruitment and HR portals

Workarounds

• Restrict network reachability of PeopleSoft/PeopleTools administrative and integration HTTP endpoints to known-good IP ranges
• Increase logging verbosity and alerting on Oracle PeopleSoft HTTP request anomalies while a patch for the new flaw is unavailable
• Take non-essential public-facing PeopleSoft-hosted portals offline or place behind additional authentication pending vendor guidance

Longer-term hardening

• Confirm the June 10, 2026 Oracle out-of-band patch for CVE-2026-35273 is applied on all PeopleTools 8.61/8.62 instances as a baseline, since this actor has now targeted PeopleSoft twice in 2026
• Network-segment PeopleSoft/EBS application tiers from cloud management planes and identity providers to blunt RCE-to-cloud pivoting
• Establish an expedited patch/mitigation SLA for Oracle enterprise-application advisories given repeated zero-day use against EBS (CVE-2025-61882) and PeopleSoft (CVE-2026-35273) by this actor cluster in 2025-2026
• Extend Salesforce/SaaS OAuth-token and vishing defenses already built for the UNC6040/UNC6395 (ShinyHunters/Scattered Spider) FLASH advisory to cover Oracle on-prem/enterprise application exposure

Affected and fixed versions

• Oracle — PeopleSoft (PeopleTools)
  Vulnerable versions: unspecified -- claimed zero-day, no vendor advisory or CVE published as of 2026-09-22
  Fixed in: none published as of 2026-09-22
• Federal Bureau of Investigation — FBIjobs.gov / apply.fbijobs.gov (Special Agent Applicant Portal)
  Vulnerable versions: hosted service, no version applicable
  Fixed in: taken offline by the FBI pending investigation
• Amazon Web Services — AWS GovCloud (US) -- FBI-managed tenant
  Vulnerable versions: hosted infrastructure, no version applicable

Timeline

Last updated 2026-09-27

• 2025-08-09 Threat actors, later attributed to Cl0p, begin exploiting CVE-2025-61882 as a zero-day against Oracle E-Business Suite Concurrent Processing / BI Publisher Integration, weeks ahead of a patch.
• 2025-10-06 Scattered Lapsus$ Hunters (including ShinyHunters) leak the CVE-2025-61882 exploit archive and partial Oracle source code, publicly asserting Cl0p obtained the exploit from them without authorization -- the origin of the ongoing ShinyHunters/Cl0p feud.
• 2026-02-17 FBI analysts detect abnormal log activity later attributed to a separate, unrelated 'major incident' breach of the FBI's Digital Collection System Network (DCSNet) wiretap/surveillance infrastructure via a compromised ISP vendor.
• 2026-03-27 Iran-linked group Handala publishes personal emails and photos it says were exfiltrated from FBI Director Kash Patel's personal Gmail account, an incident unrelated to ShinyHunters.
• 2026-05-15 The FBI publishes a FLASH/PSA bulletin naming ShinyHunters and Scattered Spider (tracked by Google as UNC6040/UNC6395) for a Salesforce data-theft extortion campaign and describing harassment tactics including swatting -- the bulletin ShinyHunters later demands be retracted.
• 2026-06-10 Oracle issues an out-of-band Security Alert patching CVE-2026-35273, a critical (CVSS 9.8) unauthenticated RCE in PeopleSoft PeopleTools 8.61/8.62; Google Threat Intelligence Group/Mandiant confirm ShinyHunters (UNC6240) had exploited it as a zero-day against 100+ organizations, mostly in education.
• 2026-09-19 ShinyHunters exploits an unauthenticated file-upload flaw in the Grav CMS powering Cl0p's dark-web leak site, seizes it, and demands an eight-figure share of Cl0p's Oracle EBS extortion proceeds.
• 2026-09-21 ShinyHunters claims it exploited a new, unpatched Oracle PeopleSoft zero-day for RCE against the FBI's locked-ioc-4 Special Agent Applicant Portal on Monday night, then moved laterally into FBI-managed AWS GovCloud infrastructure and exfiltrated an alleged 2-3TB of data.
• 2026-09-22 ShinyHunters publicly demands the FBI, addressed to Director Kash Patel and Cyber Division Assistant Director Brett Leatherman, retract the May 15 FLASH report within one week, and claims it is now exploiting the same new PeopleSoft zero-day against other organizations including Fortune 500 companies.
• 2026-09-22 ShinyHunters defaces locked-ioc-4 with its Umbreon logo and a 'seized by ShinyHunters' message; 404 Media publishes a report including a verified-partly-accurate ~5,000-record employee sample; the FBI states it is investigating claims affecting locked-ioc-9.

Update history

• 2026-09-27 — tweetfeed.live community intel: New TL_OSINT_Scan community intel: 1 newly-corroborated indicator(s), 3 community-related indicator(s).

Sources cited

• Oracle E-Business Suite Zero-Day Vulnerability (CVE-2025-61882) esentire.com · Advisory · 2025-10-04
• FBI warns of Scattered Spider and ShinyHunters attacks on Salesforce platforms The Record · Advisory · 2026-05-15
• ShinyHunters en.wikipedia.org · Research · 2026-09-22
• Active Exploitation of Oracle PeopleSoft Zero-Day (CVE-2026-35273) Rapid7 · Research · 2026-06-11
• Oracle Security Alert Advisory - CVE-2026-35273 oracle.com · Vendor report · 2026-06-10
• Critical Oracle PeopleSoft Vulnerability Actively Exploited in ShinyHunters Campaign arcticwolf.com · Research · 2026-06-11
• ShinyHunters claims FBI hack, data theft in PeopleSoft zero-day breach BleepingComputer · News · 2026-09-22
• 'We Hacked the FBI:' Hackers Say They Have Data on All FBI Employees 404media.co · News · 2026-09-22
• Hacking group ShinyHunters claims it breached the FBI, stole agents' and applicants' data techcrunch.com · News · 2026-09-22
• ShinyHunters claims FBI hack: 'This is NOT financially motivated' The Register · News · 2026-09-22
• ShinyHunters claims FBI data theft, demands bureau retract cyber warning nextgov.com · News · 2026-09-22
• ShinyHunters escalates dispute with FBI; claims to have seized job applicants' site and acquired data databreaches.net · News · 2026-09-22
• ShinyHunters hacks Clop leak site, threatens to extort ransomware gang BleepingComputer · News · 2026-09-19
• Iran-linked hackers breach FBI Director Kash Patel's personal email, publish excerpts online cnbc.com · News · 2026-03-27
• FBI investigating hack on its wiretap and surveillance systems, report says techcrunch.com · News · 2026-03-05

Related threats

• ShinyHunters Claims Breach of FBI Jobs Portal (fbijobs.gov) via Alleged Oracle PeopleSoft Zero-Day, Exposing Agent and Applicant Personal Data
• Oracle E-Business Suite TCF SQLi RCE (CVE-2026-101767) actively exploited and Oracle PeopleSoft SSRF-to-RCE chain (CVE-2026-35273) exploited by ShinyHunters (UNC6240)

More from ShinyHunters

• Higher Education Sector Under Ransomware and Extortion Pressure: Interlock (CCBC, Springfield Public Schools) and ShinyHunters (Instructure Canvas) with AI Data-Exposure Risk
• ShinyHunters Post-Arrest Brand Fight: Rival Factions, Shared Extortion Infrastructure and Impersonation (SLSH / Aegis / ShinyEquationCartel)
• 2026 Dark Web Threat Trends: Infostealer Credential Markets, Ransomware Splintering, Deepfake KYC Bypass (JINKUSU CAM), Telegram Resilience, SaaS/Identity Breaches
• Unit 42: Retail Peak Season Cyber Threats - Ransomware/Extortion, DDoS, Digital Skimming, Account Takeover and AI-Assisted Intrusion (CVE-2024-34102, CVE-2021-44228)
• September 2026 Major Cyber Attacks: ShinyHunters FBIJobs/PeopleSoft (CVE-2026-35273), Clop Leak Site Grav CMS Hijack (CVE-2026-42608), PaperCut AI-Agent Campaign, BlueMoon Zero-Day Chain, NetScaler C2 (CVE-2026-88771)
• ShinyHunters Supply-Chain Compromise via Anodot Stolen Service Tokens Leads to Snowflake Data Theft (Rockstar Games)

Other reports on CVE-2025-61882

• Top 10 Critical Threat Actors to Watch in 2026: Akira, DragonForce, Qilin, LockBit, Scattered Spider, Cl0p, Lazarus, Volt Typhoon, APT29, OilRig (CVE-2024-40766, CVE-2025-61882, CVE-2023-34362, CVE-2024-39717, CVE-2024-30088)
• Q1 2026 Industrial Cybersecurity Incidents: Sandworm/Static Tundra Polish Energy Wiper Attempts, Handala Intune Wipe of Stryker, DragonForce Ransomware at Hazeldenes
• Oracle October 2026 Critical Patch Update - 1,295 Patches Incl. Maximum-Severity E-Business Suite Workflow Flaw (CVE-2026-101809)
• Cl0p Ransomware MFT Attack Pattern: Multi-Year Zero-Day Campaigns Against File Transfer and Enterprise Software (2020-2025)
• ShinyHunters Hacks Clop Ransomware Gang's Tor Leak Site via Grav CMS File Upload Flaw, Threatens 72-Hour Extortion
• Estée Lauder Data Breach via Oracle E-Business Suite Zero-Day (CVE-2025-61882) — Clop Exploitation

Previous and next in data breach

• BigCommerce Merchant Storefronts Compromised via Stolen Ribon App Credentials, Malicious Script Injection Previous report
• Cyberattack Disrupts Dyfed-Powys Police Systems in Wales, Staff Data Possibly Compromised Next report